feat(viewer): thumbnails drawn at load, kept on disk by hash; no picture crashes it

Tiles draw a thumbnail, not the file: the top of the first page, 560
pixels wide (never scaled up) and at most 420 tall, rendered by two
workers of their own so opening a file never waits behind them. Every
file's thumbnail starts when the books load, before the documents page
is opened, and the live viewer keeps each as <sha>.png in
$XDG_CACHE_HOME (else ~/.cache)/wanderbooks/thumbs/v1-560 (private to
the user, written whole and renamed into place), so the next launch
reads small PNGs, not PDFs. A file's name is its content's hash, so a
thumbnail always matches the file the books hold; the blob is still read
through the verifying store each time, so a corrupt or missing file is
an error, never a kept picture.

From review: a picture or page past the device's largest texture is
scaled to fit (egui panicked on it, in the full view too); a renderer
panic is that file's error, not the end of its worker; a thumbnail asked
for before the cache moved is dropped, never shown over a newer one;
text thumbnails keep 2 KiB.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T3gXMVt7XJPi6ens1or9Dj

crates/ledger-gui/src/pages/documents.rs

@@ -140,7 +140,10 @@ fn tile(
     let thumb = egui::Rect::from_min_size(rect.min + vec2(10.0, 10.0), vec2(w - 20.0, 170.0));
     ui.painter()
         .rect_filled(thumb, CornerRadius::same(6), p.hover);
-    match shell.receipts.get(&a.blob_sha, &a.mime_type, b.blob_root()) {
+    match shell
+        .receipts
+        .thumb(&a.blob_sha, &a.mime_type, b.blob_root())
+    {
         Render::Ready(pages) => {
             if let Some(tex) = pages.first() {
                 // Top of the first page, filling the width.